The vulnerability in trailofbits fickling (<=0.1.10) arises because the UNSAFE_IMPORTS denylist used by the check_safety() function does not include the Python standard library modules _posixsubprocess, site, and atexit. As a result, pickle payloads that invoke dangerous functions such as _posixsubprocess.fork_exec, site.execsitecustomize, and atexit._run_exitfuncs are not detected as unsafe. The check_safety() function returns a LIKELY_SAFE verdict with zero findings, allowing the fickling.load() API to deserialize and execute these payloads. This vulnerability shares the same root cause as CVE-2026-22607, CVE-2025-67748, and CVE-2025-67747, involving incomplete denylist checks for unsafe imports in pickle deserialization contexts.

An attacker can craft malicious pickle payloads that invoke dangerous functions in the omitted modules, leading to arbitrary code execution during deserialization. This results in high confidentiality, integrity, and availability impacts as indicated by the CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using fickling versions up to and including 0.1.10 to deserialize untrusted pickle data. Consider alternative safe deserialization methods or additional application-level validation to prevent unsafe code execution.